Given the galloping pace at which information technology continues to develop and penetrate our lives, it is inevitable that the aspirations of data protection will sometimes appear like hollow promises that the law cannot keep. This makes it essential to study the precise regulatory conditions that can allow for the effective enforcement of legal protections for informational privacy. This Article provides a holistic account of the likely breadth and regulatory burden of an effective data protection regime and attempts to flesh out various regulatory tools that can go into the design of a Data Protection Authority for India so as to account for the weighty duties it must bear. Touching on the proposals of the Srikrishna Committee while drawing on the experiences of other jurisdictions, it justifies the idea of a unified, cross-sectoral data protection regulator with a broad mandate, examines the limits of sectoral regulation, and clarifies the significance of and outlook for models such as co-regulation and responsive regulation, as well as the role of the much-vaunted principle of accountability. In assessing the enforcement burdens created by the substantive rights and duties of data protection, the article also provides pointers as to what we should expect from a privacy watchdog in India and how these expectations can best be met in practice.